ClawdBites

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:29 AM UTC
• Version: 0.1.0

Overview

The skill is aimed at recipe extraction, but it needs review because it automatically downloads and analyzes reel media, installs an unpinned Python tool, and uses unsafe shared temporary files.

Install only if you are comfortable with the agent downloading public Instagram reels, transcribing audio locally, and sending extracted frames to the active vision model when captions are incomplete. Prefer a revised version that asks before audio/video analysis, uses pinned or isolated dependencies, and stores temporary media in a private per-run directory that is cleaned up afterward.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:5`, `SKILL.md:373`, and `README.md:21` **Vulnerability Type**: Unpinned dependency installation **Risk Level**: Medium ### Vulnerable Code `SKILL.md:5`: ```yaml metadata: {"clawdbot":{"emoji":"🦞","os":["darwin","linux"],"requires":{"bins":["yt-dlp","ffmpeg","whisper"]},"install":[{"id":"yt-dlp","kind":"brew","formula":"yt-dlp","bins":["yt-dlp"],"label":"Install yt-dlp via Homebrew"},{"id":"ffmpeg","kind":"brew","formula":"ffmpeg","bins":["ffmpeg"],"label":"Install ffmpeg via Homebrew"},{"id":"whisper","kind":"shell","command":"pip3 install --user openai-whisper","label":"Install Whisper (local, no API key)"}]}} ``` `SKILL.md:373`: ```markdown - `whisper` — `pip3 install openai-whisper` (runs locally, no API key) ``` `README.md:21`: ```markdown | whisper | `pip3 install openai-whisper` | ``` ### Technical Analysis The installation commands do not pin `openai-whisper` to a reviewed version and do not verify package integrity with hashes. Consequently, the package and its transitive dependencies are resolved dynamically at installation time. The code installed in the future may therefore differ from the dependency version that existed when this skill was audited. This creates a supply-chain exposure if the package distribution account, package repository, or any transitive dependency is compromised. Installing into the user environment with `--user` also exposes the user's Python environment to the selected package rather than containing it in a dedicated virtual environment. The available evidence does not establish that `openai-whisper` is malicious. The vulnerability is the absence of reproducible version and integrity controls. ### Attack Path 1. An attacker compromises a future `openai-whisper` release, a transitive dependency, or the relevant package publishing account. 2. A user installs the skill requirements by running the documented unpinned `pip3 install` command. 3. Pip resolv ...[truncated 873 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin Whisper and all transitive dependencies to reviewed versions using a lock file. 2. Require package hashes, such as through `pip install --require-hashes -r requirements.txt`. 3. Install dependencies in a dedicated virtual environment rather than the user's global or user-level Python environment. 4. Retrieve packages only from an explicitly configured, trusted package index. 5. Add an update process that reviews new dependency versions before changing the lock file. 6. Keep installation instructions consistent between `SKILL.md`, metadata, and `README.md`. 7. Where supported by the skill platform, replace an arbitrary shell installation command with a structured package declaration that enforces versions and provenance. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:34
• Finding: Predictable Shared Temporary Files Allow Collisions and File Clobbering<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:34-36`, `SKILL.md:193-203`, and `SKILL.md:321-324` **Vulnerability Type**: Unsafe temporary-file handling **Risk Level**: Medium ### Vulnerable Code `SKILL.md:34-36`: ```markdown - Download video: `yt-dlp -o "/tmp/reel.mp4" "URL"` - Extract audio: `ffmpeg -y -i /tmp/reel.mp4 -vn -acodec pcm_s16le -ar 16000 -ac 1 /tmp/reel.wav` - Transcribe: `whisper /tmp/reel.wav --model base --output_format txt --output_dir /tmp` ``` `SKILL.md:193-203`: ```bash yt-dlp -o "/tmp/reel.mp4" "https://instagram.com/reel/XXX" ``` ```bash ffmpeg -i /tmp/reel.mp4 -vn -acodec pcm_s16le -ar 16000 -ac 1 /tmp/reel.wav ``` ```bash /Users/kylekirkland/Library/Python/3.14/bin/whisper /tmp/reel.wav --model base --output_format txt --output_dir /tmp ``` `SKILL.md:321-324`: ```bash # Extract 1 frame every 5 seconds ffmpeg -i /tmp/reel.mp4 -vf "fps=1/5" /tmp/frame_%02d.jpg # Or extract specific number of frames evenly distributed ffmpeg -i /tmp/reel.mp4 -vf "select='not(mod(n,30))'" -vsync vfr /tmp/frame_%02d.jpg ``` ### Technical Analysis The workflow uses deterministic names directly under the globally shared `/tmp` directory: - `/tmp/reel.mp4` - `/tmp/reel.wav` - `/tmp/frame_%02d.jpg` - Whisper output written directly to `/tmp` These paths are predictable and reused across every invocation. No private per-run directory, atomic file creation, symlink validation, restrictive permissions, or cleanup procedure is specified. The first workflow also uses `ffmpeg -y`, which automatically overwrites an existing output. On a multi-user system, another local process may create a conflicting file or symbolic link before the workflow runs. Concurrent skill invocations can also overwrite or consume each other's media. Stale files from previous executions may be processed or disclosed in later runs. Whether a particular underlying utility follows symbolic links or refuses an existing output can vary by utility and invocation. Nev ...[truncated 1836 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a unique, private temporary directory for every invocation: ```bash workdir="$(mktemp -d)" chmod 700 "$workdir" trap 'rm -rf -- "$workdir"' EXIT ``` 2. Store every generated artifact inside that directory: ```bash video="$workdir/reel.mp4" audio="$workdir/reel.wav" yt-dlp -o "$video" "$url" ffmpeg -nostdin -i "$video" -vn -acodec pcm_s16le -ar 16000 -ac 1 "$audio" whisper "$audio" --model base --output_format txt --output_dir "$workdir" ffmpeg -nostdin -i "$video" -vf "fps=1/5" "$workdir/frame_%02d.jpg" ``` 3. Do not use fixed paths directly under `/tmp`. 4. Avoid forced overwrite options unless output files were securely created inside the private per-run directory. 5. Reject unexpected symbolic links and verify that the working directory is owned by the current user. 6. Set a restrictive `umask`, such as `umask 077`, before creating potentially private media artifacts. 7. Ensure cleanup runs on success, failure, interruption, and timeout. 8. Pass the reel URL as a separately quoted argument and use `--` where supported to prevent option confusion. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The README claims the skill can perform audio transcription, frame analysis, and smart inference, which materially expands the apparent behavior beyond the stated caption-extraction scope. Scope mismatch is dangerous because reviewers and users may grant the skill trust or permissions appropriate for a simple parser while it actually implies broader media acquisition and analysis behavior.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Advertising a wishlist capability inside a recipe-extraction skill suggests stateful data handling and cross-skill interactions that are not justified by the core purpose. Even if benign, unexplained data retention or integration features can expand attack surface and create confusion about what user data is stored or shared.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The documented workflow says the skill automatically escalates from caption parsing to audio transcription and then video frame analysis. That hidden fallback chain increases processing scope and risk, especially because it implies downloading and inspecting external media content without clearly surfacing that expanded behavior in the skill's declared purpose.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes a caption-extraction skill, but the body expands behavior to downloading reels, transcribing audio, and analyzing frames with a vision model. This scope mismatch can defeat user and platform expectations about what content will be processed, reducing informed consent and making review or policy enforcement harder.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill mandates automatic video download, audio extraction, and transcription without a user-facing warning or consent step. Even for public reels, this is a meaningful expansion of processing that may surprise users and can capture spoken content they did not intend to have transcribed.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill includes writing recipe data to local storage but does not clearly warn users that data may be persisted to disk. Silent persistence can create privacy and retention issues, especially when storing source URLs, creator identifiers, dates, and user preference data.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Frame-based vision analysis materially expands the capability from caption parsing to full visual inspection of video content, which is not justified by the manifest's stated purpose. This broader access can expose additional on-screen personal or sensitive information and creates unnecessary collection beyond the minimum needed for the task.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The README describes automatic processing of Instagram reels, including implied downloading and analysis of external media, without warning users about that behavior. This matters because external media handling can trigger network access, large downloads, unexpected local tool execution, and privacy or policy concerns that users may not anticipate from a recipe-extraction skill.

Context-Inappropriate Capability

Low

• Confidence: 88% confidence
• Finding: The integration section describes saving recipes, planner suggestions, and tracking tried recipes. Those are downstream organizational features not necessary to extract a recipe from a reel caption, making them unjustified given the manifest's narrow extraction purpose.

Description-Behavior Mismatch

Low

• Confidence: 86% confidence
• Finding: The skill documents optional persistence to local files and cross-skill handoffs, but that behavior is not reflected in the manifest. Hidden storage and data-sharing behavior increases the chance that recipe URLs, creator handles, or user preferences are retained or propagated without clear user awareness.

Static analysis

No suspicious patterns detected.